Privacy & Cookie Policy

1. Who we are

The studios operating under the brand Prescription are managed by PILARES CELESTIAIS UNIPESSOAL, LDA (NIF 517205050), which is responsible for the personal data described in this policy (the “controller”).

For any question about your data or to exercise your rights, write to hello@prescription.pt.

2. The data we use

• Account and booking data: your name, email address, phone number, date of birth, bookings, attendance, memberships, packs and purchases. This data is held in Momence, the booking and payment platform we use; when you sign in on our website, we read it from Momence to show your account.
• Payment data: your card is entered in Momence's secure form and processed by Stripe. We never see or store your full card number; our website only displays the card brand and its last four digits.
• How you found us: campaign parameters in the link you arrived from (for example utm_source, fbclid, gclid). They are kept in your browser for the visit and, when you sign up or buy, recorded against a pseudonymous identifier — never your name or email.
• Website usage: pages viewed, device and browser, and key actions (checkout started, purchase, class booked), collected by analytics and advertising tools only if you accept them in the cookie banner.
• Messages you send us, for example by email.

3. Why we use it and on what basis

• To provide our classes, bookings, payments and your online account — performance of our contract with you.
• To meet our legal obligations, such as invoicing, accounting and handling complaints — legal obligation.
• To keep the website and your account secure and working — our legitimate interest.
• To measure our website's audience and the effectiveness of our advertising — your consent, which you can withdraw at any time.

4. Who we share it with

We do not sell your data. We only share it with providers that process it on our behalf, under contract:

• Momence — bookings, client accounts and payments.
• Stripe — card payment processing.
• Vercel — website hosting and the storage of the pseudonymous campaign records described above.
• Google (Tag Manager, Analytics, Ads, Maps) — audience measurement, advertising measurement and maps, subject to your consent where required.
• Meta Platforms (Facebook, Instagram) — advertising measurement, subject to your consent. When you make a purchase, the sale can also be reported to Meta from our server with your email address in a hashed (irreversible) form, so the same purchase is not counted twice.
• Other analytics tools configured in our tag manager, such as Hotjar, only with your consent.
• If you book through ClassPass, ClassPass handles your data under its own policy.

5. Transfers outside the European Economic Area

Some of these providers are based outside the EEA, notably in the United States. Where this is the case, transfers rely on the safeguards provided by the GDPR, such as the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

6. How long we keep it

• Account and booking data: for as long as you are a client, then for the periods required by law (for example, accounting and tax records).
• Pseudonymous campaign records: for as long as they are useful to assess our marketing, and deleted on request.
• Cookies and browser storage: for the durations listed in the next section.

7. Cookies and browser storage

Strictly necessary — used without consent because the website cannot work without them:

• rx_session — keeps you signed in to your account (encrypted). 30 days.
• rx_oauth_state and rx_attr — secure your sign-in with Momence and carry the campaign you arrived from across it. 1 hour.
• NEXT_LOCALE — remembers your language (English or Portuguese).
• rx_attribution and rx_paid (browser session storage) — the campaign of your current visit and a reminder that you just made a purchase, so you are not charged twice by mistake. Deleted when you close the tab.
• Analytics and advertising — only with your consent, managed from the cookie banner: Google Analytics (e.g. _ga), Google Ads, Meta Pixel (e.g. _fbp, _fbc) and, where enabled, Hotjar. They are loaded through Google Tag Manager.
• Momence's own pages (sign-in, sign-up, card form) set their own cookies, governed by Momence's policies.

8. Your rights

Under the GDPR you can ask to access, correct or delete your data, to restrict or object to its use, to receive it in a portable format, and withdraw your consent at any time. Write to hello@prescription.pt; we reply within one month.

You can also lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.

9. Changes to this policy

We may update this policy when our services or the tools we use change. The date at the top shows the latest version.